Privacy Statement

At Pixum, we respect your privacy. Data protection and data security for customers and users are of high priority for Pixum.

We, Diginet GmbH & Co. KG, owner of the Pixum brand, Industriestraße 161, 50999 Cologne, take the protection of your personal data very seriously and comply with the legal provisions on data protection as the controller in terms of the General Data Protection Regulation (GDPR).

This privacy statement, in accordance with Art. 13 GDPR, explains what information is collected on our website and when using the Pixum App and Pixum Fotowelt through your visit, and how this information is used. However, this statement does not apply to other companies' websites that contain a link to this website or to which our website links.

If you have any questions about data protection at Pixum, please contact our Data Protection Officer:

Diginet GmbH & Co. KG
Philipp Kirschner
Industriestraße 161
50999 Köln
datenschutz@pixum.com

Images and Projects

Your image data is automatically stored for 28 days in the online gallery accessible only to you for the purpose of creating photo products after uploading.

Additionally, Pixum provides you with an optional online album storage that you can use to store the image data for a longer period. You can delete your image data in the photo inbox or album storage at any time.

Images in projects stored by you are retained for a maximum of 36 months to allow you to order them. Once your order is completed and delivered, the image data is kept in production for up to 12 weeks to handle any complaints or reorders. Thereafter, these data are irretrievably deleted.

The legal basis for processing data for the purpose of the order is Art. 6(1)(b) GDPR.

Fraud Prevention

The data you provide as part of an order may be used by Pixum to check for atypical ordering processes (e.g., simultaneous ordering of a large number of goods to the same address using different customer accounts).

The legal basis for processing data for the purpose of fraud prevention is Art. 6(1)(f) GDPR.

Offering Payment Methods

Before showing you the payment methods available for a purchase, we conduct a risk assessment. For this, your previously recorded purchase data, payment data, and profile data are used. The check and evaluation are automated using statistically justified estimates of the default risk relating to the payment methods we offer.

Every customer can still use our services as at least one common payment method is offered.

The legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in avoiding default risks.

Payments

We process your payment information for the purpose of payment processing, e.g., when you purchase a product via the Pixum Website, Pixum App, or Pixum Photo World.

Depending on the payment method, we pass on your payment information to third parties (e.g., in the case of credit card payment, to your credit card provider). To perform “strong customer authentication” according to Directive EU 2015/2366 (PSD2), information about the order (e.g., billing address, delivery address, or customer number) may be forwarded to banks and credit card providers.

The electronic payment process and the storage and processing of credit card information are handled by Computop Paygate GmbH, Schwarzenbergstraße 4, 96050 Bamberg.

The legal basis for this data processing is Art. 6(1)(a), Art. 6(1)(b), and Art. 6(1)(f) GDPR.

Order Confirmation

We are also required by legal regulations in the German Civil Code (BGB) to send an electronic order confirmation to process your email address in the event of a purchase at Pixum.

The legal basis for processing data is Art. 6(1)(c) GDPR.

Transport Service Providers

For delivery of your ordered products, we work with logistics providers/transport companies: to these, the following data may be passed on for the purpose of delivering the ordered products or, if necessary, announcing them:

• First Name

• Surname

• Postal Address

• Email Address

• Phone Number (e.g., for shipment notifications)

The legal basis for processing data is Art. 6(1)(b) GDPR.

Debt Collection

Should unpaid invoices remain open despite multiple reminders or warnings, we reserve the right to pass the data necessary for debt collection to a collection service provider for the purpose of fiduciary collection. We also reserve the right to sell the claims to this provider. The claim is then transferred to this provider, and the provider asserts the claim itself against the debtor. We work with Troy GmbH as a collection service provider.

For more information on data protection, please refer to the Troy GmbH Privacy Policy: https://www.troy-bleiben.de/datenschutzerklaerung

The legal basis for processing data is Art. 6(1)(b) GDPR.

General Information on the Customer Account

When you register with Pixum and/or place an order, Pixum processes the data necessary for the conclusion, execution, or termination of the contract with you.

This includes:

• First Name, Surname

• Billing and Delivery Address

• Email Address

• Billing and Payment Data

• Information about Completed Orders

The legal basis for this is Art. 6(1)(a) and (b) GDPR.

Furthermore, we are obliged to compare your data with various sanction lists and embargoes to ensure that we do not provide economic resources or funds to listed persons. This is to comply with foreign trade regulations and to ensure all transactions run correctly.

The legal basis is Art. 6(1)(c) GDPR.

General Information

If you contact us via email, WhatsApp, service bot, contact form, or phone, the personal data you provide will be processed. The data you provide as part of your contact will be used exclusively to process your request, including possible contact with you for this purpose.

When you contact us via WhatsApp or the service bot, we use third-party providers to collect data about you on our behalf.

The legal basis for processing this data is Art. 6(1)(b) and (f) GDPR.

Note on Data Transfers to Third Countries

To ensure the high availability of our customer service, we are occasionally supported by service providers outside the scope of GDPR. We have contracts with the service providers in accordance with Art. 44 GDPR in conjunction with the EU Standard Contractual Clauses (SCC) and regularly ensure that our very high data protection standards are fully met.

Zenloop

As part of an order or after contacting customer service, you can leave a review and comment in a feedback form. We use this data for quality management as well as for evaluating and reviewing our own processes.

To learn more about your experience with Pixum and to provide you with support and information, we may contact you via email. For this, we use the email address you have provided. You can withdraw this consent at any time by informing us via email at service@pixum.com.

To manage your feedback and reviews, we work with Zenloop GmbH, Attilastraße 18, 12529 Schönefeld. Zenloop enables us to collect and analyse feedback from our customers through various channels. This allows us to tailor and improve our offer to the needs of our customers.

Further details on Zenloop’s data protection can be found here: https://www.zenloop.com/de/legal/privacy

The legal basis for processing this data is Art. 6(1)(f) GDPR.

Trusted Shops

To display our Trusted Shops trustmark and possibly collected reviews as well as to offer Trusted Shops products for buyers after an order, the Trusted Shops Trustbadge is embedded on this website. This serves to maintain our overriding legitimate interests in an optimal marketing of our offer as part of a balancing of interests. The Trustbadge and the services advertised with it are an offer by Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne. When the Trustbadge is called up, the webserver automatically saves a so-called server log file which contains your IP address, date and time of retrieval, transferred data volume, and the requesting provider (access data) and documents the retrieval.

These access data are not evaluated and are automatically overwritten no later than seven days after your visit to the site. Further personal data will only be transmitted to Trusted Shops if you have consented, decide to use Trusted Shops products after completing an order, or have already registered for use. In this case, the contractual agreement between you and Trusted Shops applies.

Further details on Trusted Shops data protection can be found here: https://www.trustedshops.de/impressum-datenschutz

The legal basis for this data processing is Art. 6(1)(f) GDPR.

Trustpilot

Pixum may contact you via email to invite you to review the service and/or products you have received from us in order to gather your feedback and improve our service and products ("Purpose"). Since we work with an external company, Trustpilot A/S, for customer feedback collection, we will share your name, email address, and reference number with Trustpilot for this purpose.

Further details on Trustpilot’s data protection can be found here: https://de.legal.trustpilot.com/for-reviewers/end-user-privacy-terms

The legal basis for this data processing is Art. 6(1)(f) GDPR.

Processors

Pixum uses processors for the processing of your data. A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. Processors do not use the data for their own purposes but solely for the controller.

We adhere to the requirements of Art. 28 GDPR in this regard.

Other Recipients

Pixum also uses other service providers necessary for the provision of services and the achievement of various purposes. Pixum transmits data to these companies if necessary for the provision of services, e.g., to affiliate networks for billing purposes.

The legal basis for this data transmission is Art. 6(1)(a), (b), (f) GDPR.

Postal Advertising

If we obtain your address in connection with your order and you have not objected, we reserve the right to regularly send you offers by post for similar products from our range to those you have already purchased. This serves to protect our interests in advertising communication with our customers.

You can object to the use of your address at any time by emailing service@pixum.com.

The legal basis for this data processing is Art. 6(1)(f) GDPR.

Email Newsletter

When you sign up for the newsletter, your email address is used for our own advertising purposes. If you sign up for our newsletter, we use the required or separately provided data to regularly send you our email newsletter. You can unsubscribe from the newsletter at any time by using the link provided in the newsletter, via your customer account, or by contacting customer service.

The legal basis for this data processing is Art. 6(1)(a) GDPR.

Newsletter Delivery via WhatsApp

These privacy notes inform you about the processing of your personal data if you wish to regularly receive the WhatsApp newsletter from Pixum. By sending a start message, you agree to the validity of our internal data protection regulations.

In particular, you consent to your personal data (name and surname, telephone number, messenger ID, IP address, profile picture, and the chat history) being stored, processed, and used to send messages to you as part of using the WhatsApp messenger service. An active account with the respective provider is required to use the WhatsApp messenger service.

You are also aware that for this service, MessengerPeople GmbH, Seidlstraße 8, 80335 Munich is used as a technical service provider and processor.

Your consent to the processing of personal data is always revocable. A corresponding notification is sufficient for this. You can revoke your consent at any time by sending the message "STOP" in the WhatsApp chat. Further information can be found in our privacy policy as well as in those of WhatsApp and MessengerPeople GmbH.

The legal basis for this data processing is Art. 6(1)(a) GDPR.

UWG Newsletter (Email Advertising for Similar Products and Services)

To inform existing customers about products in their area of interest, we inform them about these products via email. Existing customers will receive these individual product recommendations even if they have not subscribed to our newsletter. We make the selection of individual product recommendations based on the data and information used during your purchases.

You can object to individual product recommendations at any time in your customer account, through a notification to customer service, or by using the link provided in the product recommendation.

The legal basis for this data processing is Art. 6(1)(f) GDPR.

Cookies

Cookies and similar technologies are used on the Pixum Website, Pixum App, and Pixum Fotowelt. Cookies are small text files that your browser automatically creates and stores on your device. However, this does not mean that we will immediately know your identity.

If not technically necessary, you agree to this by giving your consent in the consent settings when the page loads for the first time.

The legal basis for this is Art. 6(1)(a) GDPR.

If such storage or retrieval is necessary for the website or the Pixum App offering, this can happen without consent.

Necessity is given, for example, to ensure the following functionalities and achieve the following purposes:

• Providing individual "features" (display of the shopping cart, enabling and maintaining the log-in, integration of payment providers, etc.)

• Ensuring security

• Fulfilling legal requirements (e.g. document the granting/withdrawal of tracking opt-ins)

In terms of data processing required for the operation of the website, Pixum App, and Pixum Fotowelt, you have no right to objection.

The legal basis for this is Art. 6(1)(c), (f) GDPR.

Data Processing by Third-Party Providers after Consent

Further information and individual settings options can be found in the consent settings. There, all tags, trackers for affiliate partners, testing and analysis tools we use on the Pixum Website are listed. For each of these tools, you will find detailed information and contact options for the responsible parties.

You can withdraw your consent at any time by deselecting or deactivating them individually.

Pseudonymisation of Personal Data without Consent

If there is no consent for data processing, we apply a so-called de-identification mechanism. This server-side solution by Jentis automatically truncates IP addresses by the last digit on our Jentis Twin Server so that it becomes impossible to identify a specific European visitor solely based on the IP address.

In addition, other identifiers from analytics providers are replaced by randomly generated numbers, so that visitors to the Pixum Website cannot be filtered or re-identified by third-party providers. The server-side solution by Jentis aims to ensure an optimal level of protection for the personal data we process.

Use of YouTube

The Pixum Website uses social plug-ins from YouTube (Google). It is an offering by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

When you visit a page that contains such a plug-in, your browser establishes a connection to YouTube, and the contents are loaded from these pages. Your visit to this website can then be traced by YouTube, even if you do not actively use the function of the social plug-in. If you have an account with YouTube, you can use such a social plug-in and share information with your friends.

Pixum has no influence on the content of the plug-ins and the information transmission.

Google provides detailed information about the extent, type, purpose, and further processing of your data on its website. Here, you will also find further information about your rights and settings to protect your privacy.

Google's Privacy Policy: https://www.google.com/intl/de/policies/privacy

The legal basis for this is your consent under Art. 6(1)(a) GDPR.

Use of Facebook

The Pixum website uses social plug-ins from Meta (“Facebook”). It is an offering by Meta (Willow Road 1601 94025 Menlo Park, CA, USA).

When you visit a page that contains such a plug-in, your browser establishes a connection to Facebook, and the contents are loaded from these pages. Your visit to this website can then be traced by Facebook, even if you do not actively use the function of the social plug-in. If you have an account with Facebook, you can use such a social plug-in and share information with your friends.

Pixum has no influence on the content of the plug-ins and the information transmission.

Facebook provides detailed information about the extent, type, purpose, and further processing of your data on its website. Here, you will also find further information about your rights and settings to protect your privacy.

Facebook's Privacy Policy: https://www.facebook.com/about/privacy

The legal basis for this is your consent under Art. 6(1)(a) GDPR.

Use of Pinterest

For the purpose of analysing usage behaviour, the effectiveness of online marketing measures, and selecting online advertising on other platforms, we use plug-ins from Pinterest, which are automatically selected based on real-time bidding.

Data is transmitted to the independent controller Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. This may also include the transmission of personal data to a country outside the European Union.

Further information on data processing by Pinterest can be found in Pinterest's privacy policy: https://policy.pinterest.com/de/privacy-policy

The legal basis for this is your consent under Art. 6(1)(a) GDPR.

Use of TikTok

For the purpose of analysing usage behaviour, the effectiveness of online marketing measures, and selecting online advertising on other platforms, we use plug-ins from TikTok, which are automatically selected based on real-time bidding.

Data is transmitted to the independent controller TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. This may also include the transmission of personal data to a country outside the European Union.

Further information on data processing by TikTok can be found in TikTok's privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE

The legal basis for this is your consent under Art. 6(1)(a) GDPR.

Except for the processing activities where we inform you about the possibility of data transfer to recipients located outside the EU in these data protection notices, we do not transfer your data to recipients located outside the European Union or the European Economic Area. Data transfers are generally based on the so-called Standard Contractual Clauses (SCC) of the EU Commission or a valid adequacy decision.

When processing your personal data, the EU General Data Protection Regulation (GDPR) grants you certain rights.

Right of Access (Art. 15 GDPR)

You have the right to request confirmation as to whether personal data concerning you is being processed. If this is the case, you have the right to access this personal data and the information listed in detail in Art. 15 GDPR.

Right to Rectification and Erasure (Art. 16 and 17 GDPR)

You have the right to request the rectification of inaccurate personal data concerning you without undue delay and, where applicable, the completion of incomplete personal data. You also have the right to request the erasure of personal data concerning you without undue delay, provided one of the grounds listed in Art. 17 GDPR applies, e.g., if the data is no longer needed for the purposes pursued.

Right to Restrict Processing (Art. 18 GDPR)

You have the right to request the restriction of processing where one of the conditions listed in Art. 18 GDPR applies, e.g., if you have objected to the processing, for the duration of any verification.

Right to Data Portability (Art. 20 GDPR)

In certain cases outlined in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format or to request the transmission of this data to a third party.

Right to Object (Art. 21 GDPR)

If data is collected on the basis of Art. 6(1)(f) GDPR (data processing for the purposes of legitimate interests), you have the right to object to the processing at any time on grounds relating to your particular situation.

We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is for the establishment, exercise, or defence of legal claims.

Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

Under Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of data concerning you infringes data protection regulations. The right to lodge a complaint may, in particular, be exercised at a supervisory authority in the member state of your habitual residence, place of work, or the place of the alleged infringement.

As of June 2024